System and method for rotating client security keys

ABSTRACT

Systems, methods, and non-transitory computer-readable storage media for rotating security keys for an online synchronized content management system client. A client having a first security key as an active security key may send a request to a server for a new security key as a replacement for the first security key. The server may receive the request and generate a candidate security key. The server can issue the candidate security key to the client device. After receiving the candidate security key, the client may send a key receipt confirmation message to the server. In response to the confirmation message, the server may mark the candidate key as the new security key for the client and discard the client&#39;s old security key. The server may send an acknowledgment message to the client device. In response, the client may also mark the candidate key as its new active key.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/513,938, filed Oct. 14, 2014, entitled “System and Method forRotating Client Security Keys” the content of which is incorporatedherein by reference in its entirety.

TECHNICAL FIELD

The present technology pertains to online synchronized contentmanagement systems, and more specifically pertains to a technique forrotating security keys for client devices.

BACKGROUND

Many online services rely on user credentials, such as a username andpassword, to authenticate a user or her client application. For example,a user trying to use an online synchronized content management system,such as Dropbox™ from Dropbox Inc. of San Francisco, Calif., may beasked to input her username and password into her web browser or herlocal client application before she can access content on the contentmanagement system's server.

In other instances, however, an online service may generate and issue asecurity key—a large randomly generated value that is computationallydifficult to guess—to the client so that the client can laterauthenticate itself to the server with the key. This can simplify theuser authentication process because the client does not have to ask theuser to input her credentials each time the client attempts tocommunicate with the server. The security key can be transferred fromthe server to the client and stored inside the client device, such as inthe form of a session cookie or a file saved in a secure location.

However, if the security key falls into the wrong hands, it can allow amalicious attacker to access the content belonging to the user accountassociated with the security key. For example, Brian may have installeda client application for an online synchronized content managementservice on his laptop computer. After Brian logs into the clientapplication with his correct username and password, the applicationdownloads a unique security key from the content management service'sserver. Brian can now use the application without having to enter thecredentials every time because the client application can authenticateand communicate with the server using the security key. However, Brian,while using his laptop at a coffee shop, meets Susan, who asks Brian ifshe can borrow his laptop for a few minutes to browse the Internet.Unbeknownst to Brian, Susan is a malicious hacker who proceeds to stealBrian's security key by locating the file containing the key and copyingthe file on to her portable storage device. Using the stolen securitykey, Susan may be able to impersonate Brian and successfully access,from her own computer, his online files and folders on the contentmanagement service's server. Susan may not be required by the server toenter Brian's user credentials because she is in possession of Brian'ssecurity key.

In other instances, a security key can be compromised when a user deviceis lost or stolen. If the misplaced device contains a security key inits storage, then the security key can be exposed to a malicious userand similarly exploited. Thus, what is needed is a way for the onlinecontent management system and its client application to minimize theharm that can be caused by misuse of the security key.

SUMMARY

Additional features and advantages of the disclosure will be set forthin the description which follows, and in part will be obvious from thedescription, or can be learned by practice of the herein disclosedprinciples. The features and advantages of the disclosure can berealized and obtained by means of the instruments and combinationsparticularly pointed out in the appended claims. These and otherfeatures of the disclosure will become more fully apparent from thefollowing description and appended claims, or can be learned by thepractice of the principles set forth herein.

Disclosed are systems, methods, and non-transitory computer-readablestorage media for securely rotating keys between clients and servers. Anonline synchronized content management system may be run by one or moreservers. Client applications installed on client devices can communicatewith the servers to access content stored in the content managementsystem. Each client application or device may be assigned a uniquesecurity key that can be used to authenticate and communicate with aserver. A client device may send a request to the server for a newsecurity key as a replacement for the current active security key. Theserver may receive the request and generate a candidate security key.The server can then issue the candidate security key to the clientdevice. After receiving the candidate security key, the client can senda key receipt confirmation message to the server. The server may nowmark the candidate key as the new security key for the client anddiscard the client's old security key. The server can then send anacknowledgment message to the client device. In response, the client mayalso mark the candidate key as its new active key and retire the oldkey.

The key rotation may be mandated by the server or it can be initiated bythe client. In the former case, the server may notify the client thatthe client's current security key has expired or is about to expire.This notification may have been triggered by a normal operation requestfrom the client and the server determining at that point that the keyneeds renewal. For key rotations initiated by the client, the client mayhave an internal timer that triggers key rotation on a fixed or dynamictime schedule.

BRIEF DESCRIPTION OF THE DRAWINGS

The above-recited and other advantages and features of the disclosurewill become apparent by reference to specific embodiments thereof whichare illustrated in the appended drawings. Understanding that thesedrawings depict only exemplary embodiments of the disclosure and are nottherefore to be considered to be limiting of its scope, the principlesherein are described and explained with additional specificity anddetail through the use of the accompanying drawings in which:

FIG. 1 shows an exemplary content management system configured tocommunicate with other devices via a network;

FIG. 2A shows the first exemplary system embodiment for implementingvarious embodiments of the present technology;

FIG. 2B shows the second exemplary system embodiment for implementingvarious embodiments of the present technology;

FIG. 3 shows exemplary client and server storing security keys;

FIG. 4 shows a first sequence diagram for an exemplary key rotationprotocol;

FIG. 5 shows a second sequence diagram for the exemplary key rotationprotocol;

FIG. 6 shows a third sequence diagram for the exemplary key rotationprotocol;

FIG. 7 shows an exemplary method embodiment; and

FIG. 8 shows another exemplary method embodiment.

DESCRIPTION

Various embodiments of the disclosure are discussed in detail below.While specific implementations are discussed, it should be understoodthat this is done for illustration purposes only. A person skilled inthe relevant art will recognize that other components and configurationsmay be used without parting from the spirit and scope of the disclosure.

The disclosed technology addresses the need in the art for securely andperiodically distributing secret keys from a server to client devices.The term “client application” as used herein may refer to a piece ofexecutable code that may reside on a client device for the purpose ofaccessing user content on the server and/or synchronizing user contentbetween the client device and the server. A client application may alsobe called client software, a client-side application or a desktop clientapplication (or simply a desktop client). Although a client applicationis typically a native application run on the client device's operatingsystem, a client application can also be a general-purpose applicationsuch as a web browser. A client application may run in the background toconstantly and automatically synchronize data between the client and theserver with minimal or no input from the client's user. The clientapplication may be configured to start automatically when the clientdevice is switched on to provide constant access to the server, and torestart when the client device restarts.

The term “security key” as used herein may refer to a randomly generatedvalue that is unique to a user account, an instance of a clientapplication, or a client device. Thus, the security key may uniquelyidentify the associated user, client application, or client device.Security keys may also be referred to as secret keys, master keys, ordevice security keys. Security keys may be placed on the client deviceto allow the client to authenticate all of its operations conducted withthe server. Although the term “security key” may refer to the key valueitself, it may also refer to a file that contains the key value. Thus,the security key can be a text file, a binary file, a cookie, etc.

The term “active security key” or simply “active key” as used herein mayrefer to a security key that is associated with a client device orclient application, and that is currently in use between the client andthe server. The term “current security key” (or “current key”) may beused interchangeably. This is in contrast to a “candidate security key”or simply “candidate key,” which may be considered a candidate to becomean active key if and when the client and the server agree to use it asthe next active key and mark it as such.

The terms “old security key” and “new security key” (and their shortenedforms “old key” and “new key”) as used herein may be relative terms thatare used to indicate whether a given security key, with respect to a keyrotation, is the key being replaced or the key replacing the existingkey. Thus, the active key before a key rotation can be considered an oldkey, and the active key after the key rotation can be considered a newkey. Sometimes, a candidate key may also be referred to as a new keyrelative to the (currently) active key.

The term “key rotation” as used herein may refer to a process ofreplacing one security key for another. It may also be referred to as akey renewal, a key refresh, or a key exchange.

With respect to implementing various embodiments of the disclosedtechnology, an exemplary system configuration 100 is shown in FIG. 1,wherein electronic devices communicate via a network for purposes ofexchanging content and other data. The system can be configured for useon a wide area network such as that illustrated in FIG. 1. However, thepresent principles are applicable to a wide variety of networkconfigurations that facilitate the intercommunication of electronicdevices. For example, each of the components of system 100 in FIG. 1 canbe implemented in a localized or distributed fashion in a network.

In system 100, a user can interact with content management system 106through client devices 102 ₁, 102 ₂, . . . , 102 _(n) (collectively“102”) connected to network 104 by direct and/or indirect communication.Content management system 106 may be also called an online synchronizedcontent management system, an online content management system, a filehosting service, a cloud storage service, a personal cloud service, etc.Online synchronized content system 106 can support connections from avariety of different client devices, such as desktop computers, mobilecomputers, mobile communications devices (e.g., mobile phones, smartphones, tablets), smart televisions, set-top boxes, and/or any othernetwork enabled computing devices. Client devices 102 can be of varyingtype, capabilities, operating systems, etc. Furthermore, contentmanagement system 106 can concurrently accept connections from andinteract with multiple client devices 102.

In general, network 104 is a geographically distributed collection ofnodes interconnected by communication links and segments fortransporting data between end nodes, such as personal computers andworkstations, or other devices, such as sensors, etc. Network 104 caninclude a wide area network (WAN) and a public network, such as theInternet, but can also include a private or quasi-private network, suchas an intranet, a home network, a virtual private network (VPN), ashared collaboration network between separate entities, etc. Indeed, theprinciples set forth herein can be applied to many types of networks,such as local area networks (LANs), virtual LANs (VLANs), corporatenetworks, wide area networks, and virtually any other form of suitablewired or wireless network.

A user can interact with content management system 106 via a client-sideapplication installed on client device 102 _(i). In some embodiments,the client-side application can include a content management systemspecific component. For example, the component can be a stand-aloneapplication, one or more application plug-ins, and/or a browserextension. However, the user can also interact with content managementsystem 106 via a third-party application, such as a web browser, thatresides on client device 102 _(i) and is configured to communicate withcontent management system 106. In either case, the client-sideapplication can present a user interface (UI) for the user to interactwith content management system 106. For example, the user can interactwith the content management system 106 via a client-side applicationintegrated with the file system or via a webpage displayed using a webbrowser application.

Content management system 106 can make it possible for a user to storecontent, as well as perform a variety of content management tasks, suchas retrieve, modify, browse, and/or share the content. Furthermore,content management system 106 can make it possible for a user to accessthe content from multiple client devices 102. For example, client device102 _(i) can upload content to content management system 106 via network104. The content can later be retrieved from content management system106 using the same client device 102 _(i) or some other client device102 _(j).

To facilitate the various content management services, a user can createan account with content management system 106. The account informationcan be maintained in user account database 150. User account database150 can store profile information for registered users. In some cases,the only personal information in the user profile can be a usernameand/or email address. However, content management system 106 can also beconfigured to accept additional user information.

User account database 150 can also include account managementinformation, such as account type, e.g. free or paid; usage information,e.g. file edit history; maximum storage space authorized; storage spaceused; content storage locations; security settings; personalconfiguration settings; content sharing data; etc. Account managementmodule 124 can be configured to update and/or obtain user accountdetails in user account database 150. The account management module 124can be configured to interact with any number of other modules incontent management system 106.

An account can be used to store content, such as digital data,documents, text files, audio files, video files, etc., from one or moreclient devices 102 authorized on the account. The content can alsoinclude folders or other mechanisms of grouping content items togetherwith different behaviors, such as collections, playlists, albums, etc.For example, an account can include a public folder that is accessibleto any user. The public folder can be assigned a web-accessible address.A link to the web-accessible address can be used to access the contentsof the public folder. In another example, an account can include aphotos folder that is intended for photos and that provides specificattributes and actions tailored for photos; an audio folder thatprovides the ability to play back audio files and perform other audiorelated actions; or other special purpose folders. An account can alsoinclude shared folders or group folders that are linked with andavailable to multiple user accounts. The permissions for multiple usersmay be different for a shared folder.

The content can be stored in content storage 160. Content storage 160can be a storage device, multiple storage devices, or a server.Alternatively, content storage 160 can be a cloud storage provider ornetwork storage accessible via one or more communications networks.Content management system 106 can hide the complexity and details fromclient devices 102 so that client devices 102 do not need to knowexactly where the content items are being stored by content managementsystem 106. In one variation, content management system 106 can storethe content items in the same folder hierarchy as they appear on clientdevice 102 _(i). However, content management system 106 can store thecontent items in its own order, arrangement, or hierarchy. Contentmanagement system 106 can store the content items in a networkaccessible storage (SAN) device, in a redundant array of inexpensivedisks (RAID), etc. Content storage 160 can store content items using oneor more partition types, such as FAT, FAT32, NTFS, EXT2, EXT3, EXT4,ReiserFS, BTRFS, and so forth.

Content storage 160 can also store metadata describing content items,content item types, and the relationship of content items to variousaccounts, folders, or groups. The metadata for a content item can bestored as part of the content item or can be stored separately. In onevariation, each content item stored in content storage 160 can beassigned a system-wide unique identifier.

Content storage 160 can decrease the amount of storage space required byidentifying duplicate files or duplicate segments of files. Instead ofstoring multiple copies, content storage 160 can store a single copy andthen use a pointer or other mechanism to link the duplicates to thesingle copy. Similarly, content storage 160 can store files moreefficiently, as well as provide the ability to undo operations, by usinga file version control that tracks changes to files, different versionsof files (including diverging version trees), and a change history. Thechange history can include a set of changes that, when applied to theoriginal file version, produce the changed file version.

Content management system 106 can be configured to support automaticsynchronization of content from one or more client devices 102. Thesynchronization can be platform agnostic. That is, the content can besynchronized across multiple client devices 102 of varying type,capabilities, operating systems, etc. For example, client device 102_(i) can include client software, which synchronizes, via asynchronization module 132 at content management system 106, content inclient device 102 _(i)'s file system with the content in an associateduser account. In some cases, the client software can synchronize anychanges to content in a designated folder and its sub-folders, such asnew, deleted, modified, copied, or moved files or folders. The clientsoftware can be a separate software application, can integrate with anexisting content management application in the operating system, or somecombination thereof. In one example of client software that integrateswith an existing content management application, a user can manipulatecontent directly in a local folder, while a background process monitorsthe local folder for changes and synchronizes those changes to contentmanagement system 106. Conversely, the background process can identifycontent that has been updated at content management system 106 andsynchronize those changes to the local folder. The client software canprovide notifications of synchronization operations, and can provideindications of content statuses directly within the content managementapplication. Sometimes client device 102 _(i) may not have a networkconnection available. In this scenario, the client software can monitorthe linked folder for file changes and queue those changes for latersynchronization to content management system 106 when a networkconnection is available. Similarly, a user can manually stop or pausesynchronization with content management system 106.

A user can also view or manipulate content via a web interface generatedand served by user interface module 122. For example, the user cannavigate in a web browser to a web address provided by contentmanagement system 106. Changes or updates to content in the contentstorage 160 made through the web interface, such as uploading a newversion of a file, can be propagated back to other client devices 102associated with the user's account. For example, multiple client devices102, each with their own client software, can be associated with asingle account and files in the account can be synchronized between eachof the multiple client devices 102.

Content management system 106 can include a communications interface 120for interfacing with various client devices 102, and can interact withother content and/or service providers 109 ₁, 109 ₂, . . . , 109 _(n)(collectively “109”) via an Application Programming Interface (API).Content management system 106 may receive a key renewal request, issue acandidate key, receive a key receipt confirmation message, send anacknowledgment message, etc. via communications interface 120. Certainsoftware applications can access content storage 160 via an API onbehalf of a user. For example, a software package, such as an app on asmartphone or tablet computing device, can programmatically make callsdirectly to content management system 106, when a user providescredentials, to read, write, create, delete, share, or otherwisemanipulate content. Similarly, the API can allow users to access all orpart of content storage 160 through a web site.

Content management system 106 can also include authenticator module 126,which can verify user credentials, security tokens, security keys, APIcalls, specific client devices, and so forth, to ensure only authorizedclients and users can access files. Authenticator module 126 may includea key generator sub-module that is capable of generating random numbersor alphanumeric strings that can be used as security keys. The keygenerator can be based on software, hardware, or combination of both.Authenticator module 126 may also store one or more security keys thatare associated with various client devices. The security keys can beused to authenticate the client devices. Authenticator module 126 mayalso store one or more candidate security keys, which are generated bythe key generator but not yet have been designated as an active securitykey for a client device. Furthermore, content management system 106 caninclude analytics module 134 that can track and report on aggregate fileoperations, user actions, network usage, total storage space used, aswell as other technology, usage, or business metrics. A privacy and/orsecurity policy can prevent unauthorized access to user data stored withcontent management system 106.

Content management system 106 can include sharing module 130 formanaging sharing content publicly or privately. Sharing content publiclycan include making the content item accessible from any computing devicein network communication with content management system 106. Sharingcontent privately can include linking a content item in content storage160 with two or more user accounts so that each user account has accessto the content item. The sharing can be performed in a platform agnosticmanner. That is, the content can be shared across multiple clientdevices 102 of varying type, capabilities, operating systems, etc. Thecontent can also be shared across varying types of user accounts.

In some embodiments, content management system 106 can be configured tomaintain a content directory identifying the location of each contentitem in content storage 160. The content directory can include a uniquecontent entry for each content item stored in the content storage.

A content entry can include a content path that can be used to identifythe location of the content item in a content management system. Forexample, the content path can include the name of the content item and afolder hierarchy associated with the content item. For example, thecontent path can include a folder or path of folders in which thecontent item is placed as well as the name of the content item. Contentmanagement system 106 can use the content path to present the contentitems in the appropriate folder hierarchy.

A content entry can also include a content pointer that identifies thelocation of the content item in content storage 160. For example, thecontent pointer can include the exact storage address of the contentitem in memory. In some embodiments, the content pointer can point tomultiple locations, each of which contains a portion of the contentitem.

In addition to a content path and content pointer, a content entry canalso include a user account identifier that identifies the user accountthat has access to the content item. In some embodiments, multiple useraccount identifiers can be associated with a single content entryindicating that the content item has shared access by the multiple useraccounts.

To share a content item privately, sharing module 130 can be configuredto add a user account identifier to the content entry associated withthe content item, thus granting the added user account access to thecontent item. Sharing module 130 can also be configured to remove useraccount identifiers from a content entry to restrict a user account'saccess to the content item.

To share content publicly, sharing module 130 can be configured togenerate a custom network address, such as a uniform resource locator(URL), which allows any web browser to access the content in contentmanagement system 106 without any authentication. To accomplish this,sharing module 130 can be configured to include content identificationdata in the generated URL, which can later be used to properly identifyand return the requested content item. For example, sharing module 130can be configured to include the user account identifier and the contentpath in the generated URL. Upon selection of the URL, the contentidentification data included in the URL can be transmitted to contentmanagement system 106 which can use the received content identificationdata to identify the appropriate content entry and return the contentitem associated with the content entry.

In addition to generating the URL, sharing module 130 can also beconfigured to record that a URL to the content item has been created. Insome embodiments, the content entry associated with a content item caninclude a URL flag indicating whether a URL to the content item has beencreated. For example, the URL flag can be a Boolean value initially setto 0 or false to indicate that a URL to the content item has not beencreated. Sharing module 130 can be configured to change the value of theflag to 1 or true after generating a URL to the content item.

In some embodiments, sharing module 130 can also be configured todeactivate a generated URL. For example, each content entry can alsoinclude a URL active flag indicating whether the content should bereturned in response to a request from the generated URL. For example,sharing module 130 can be configured to only return a content itemrequested by a generated link if the URL active flag is set to 1 ortrue. Thus, access to a content item for which a URL has been generatedcan be easily restricted by changing the value of the URL active flag.This allows a user to restrict access to the shared content item withouthaving to move the content item or delete the generated URL. Likewise,sharing module 130 can reactivate the URL by again changing the value ofthe URL active flag to 1 or true. A user can thus easily restore accessto the content item without the need to generate a new URL.

While content management system 106 is presented with specificcomponents, it should be understood by one skilled in the art, that thearchitectural configuration of system 106 is simply one possibleconfiguration and that other configurations with more or less componentsare also possible.

FIG. 2A and FIG. 2B show exemplary possible system embodiments. Forexample, content management system 106, client devices 102, and/orservice providers 109, as shown in FIG. 1, may each be implemented asexemplary system 200 of FIG. 2A or exemplary system 250 of FIG. 2B.Moreover, client device 302, server 304, client 402, server 404, client502, and server 504, as will be discussed later, may each be implementedas exemplary system 200 of FIG. 2A or exemplary system 250 of FIG. 2B.The more appropriate embodiment will be apparent to those of ordinaryskill in the art when practicing the present technology. Persons ofordinary skill in the art will also readily appreciate that other systemembodiments are possible.

FIG. 2A illustrates a conventional system bus computing systemarchitecture 200 wherein the components of the system are in electricalcommunication with each other using a bus 205. Exemplary system 200includes a processing unit (CPU or processor) 210 and a system bus 205that couples various system components including the system memory 215,such as read only memory (ROM) 220 and random access memory (RAM) 225,to the processor 210. The system 200 can include a cache of high-speedmemory connected directly with, in close proximity to, or integrated aspart of the processor 210. The system 200 can copy data from the memory215 and/or the storage device 230 to the cache 212 for quick access bythe processor 210. In this way, the cache can provide a performanceboost that avoids processor 210 delays while waiting for data. These andother modules can control or be configured to control the processor 210to perform various actions. Other system memory 215 may be available foruse as well. The memory 215 can include multiple different types ofmemory with different performance characteristics. The processor 210 caninclude any general purpose processor and a hardware module or softwaremodule, such as module 1 232, module 2 234, and module 3 236 stored instorage device 230, configured to control the processor 210 as well as aspecial-purpose processor where software instructions are incorporatedinto the actual processor design. The processor 210 may essentially be acompletely self-contained computing system, containing multiple cores orprocessors, a bus, memory controller, cache, etc. A multi-core processormay be symmetric or asymmetric.

To enable user interaction with the computing device 200, an inputdevice 245 can represent any number of input mechanisms, such as amicrophone for speech, a touch-sensitive screen for gesture or graphicalinput, keyboard, mouse, motion input, speech and so forth. An outputdevice 235 can also be one or more of a number of output mechanismsknown to those of skill in the art. In some instances, multimodalsystems can enable a user to provide multiple types of input tocommunicate with the computing device 200. The communications interface240 can generally govern and manage the user input and system output.There is no restriction on operating on any particular hardwarearrangement and therefore the basic features here may easily besubstituted for improved hardware or firmware arrangements as they aredeveloped.

Storage device 230 is a non-volatile memory and can be a hard disk orother types of computer readable media which can store data that areaccessible by a computer, such as magnetic cassettes, flash memorycards, solid state memory devices, digital versatile disks, cartridges,random access memories (RAMs) 225, read only memory (ROM) 220, andhybrids thereof.

The storage device 230 can include software modules 232, 234, 236 forcontrolling the processor 210. Other hardware or software modules arecontemplated. The storage device 230 can be connected to the system bus205. In one aspect, a hardware module that performs a particularfunction can include the software component stored in acomputer-readable medium in connection with the necessary hardwarecomponents, such as the processor 210, bus 205, display 235, and soforth, to carry out the function.

FIG. 2B illustrates a computer system 250 having a chipset architecturethat can be used in executing the described method and generating anddisplaying a graphical user interface (GUI). Computer system 250 is anexample of computer hardware, software, and firmware that can be used toimplement the disclosed technology. System 250 can include a processor255, representative of any number of physically and/or logicallydistinct resources capable of executing software, firmware, and hardwareconfigured to perform identified computations. Processor 255 cancommunicate with a chipset 260 that can control input to and output fromprocessor 255. In this example, chipset 260 outputs information tooutput 265, such as a display, and can read and write information tostorage device 270, which can include magnetic media, and solid statemedia, for example. Chipset 260 can also read data from and write datato RAM 275. A bridge 280 for interfacing with a variety of userinterface components 285 can be provided for interfacing with chipset260. Such user interface components 285 can include a keyboard, amicrophone, touch detection and processing circuitry, a pointing device,such as a mouse, and so on. In general, inputs to system 250 can comefrom any of a variety of sources, machine generated and/or humangenerated.

Chipset 260 can also interface with one or more communication interfaces290 that can have different physical interfaces. Such communicationinterfaces can include interfaces for wired and wireless local areanetworks, for broadband wireless networks, as well as personal areanetworks. Some applications of the methods for generating, displaying,and using the GUI disclosed herein can include receiving ordereddatasets over the physical interface or be generated by the machineitself by processor 255 analyzing data stored in storage 270 or 275.Further, the machine can receive inputs from a user via user interfacecomponents 285 and execute appropriate functions, such as browsingfunctions by interpreting these inputs using processor 255.

It can be appreciated that exemplary systems 200 and 250 can have morethan one processor 210 or be part of a group or cluster of computingdevices networked together to provide greater processing capability.

FIG. 3 shows exemplary client and server storing security keys. Inparticular, in this exemplary communication session 300, client device302 and server 304 may communicate with each other via network 306.Client device 302 can be, for example, one of client devices 102 asshown in FIG. 1. On the other hand, server 304 can be part of onlinesynchronized content management system 106 of FIG. 1. Network 306 can besimilar to network 104 as shown in FIG. 1. In other words, network 306may range from local area networks (LANs) to wide area networks (WANs).LANs typically connect these nodes over dedicated private communicationslinks located in the same general physical location, such as a buildingor campus. WANs, on the other hand, typically connect geographicallydispersed nodes over long-distance communications links, such as commoncarrier telephone lines, optical lightpaths, synchronous opticalnetworks (SONET), synchronous digital hierarchy (SDH) links, etc.

Client device 302 may be a user device, such as a computer, a mobilecommunications device, a smart television, a set-top box, or any othernetwork-enabled computing device. Client device 302 may store thereonvarious types of user content (not shown in FIG. 3), such as digitaldata, documents, text files, video files, etc. in the forms of files andfolders. Client-side application 310, installed on client device 302,can synchronize the content stored on client device 302 with server 304so that duplicate copies of the user data may be maintained on server304 and/or additional client devices (not shown in FIG. 3). Clientdevice 302 may also be equipped with communications interface 308, suchas a modem, a network interface controller (NIC), an Ethernet adapter, aWi-Fi adapter, etc., that enables client device 302 to connect tonetwork 306 and communicate with server 304 and/or other client devices.Client application 310 can interact with communications interface 308 tocommunicate with server 304 and synchronize content items. Client device302 may include other software and/or hardware modules and componentsnot shown in FIG. 3.

Client application 310 may include security module 312 and/or timermodule 314. In some embodiments, however, security module 312 and/ortimer module 314 may exist as a separate module from client application310. Security module 312 of client device 302 can work in conjunctionwith server 304—especially authenticator module 322 of server 304—toensure that client application's 310 access to server 304 is authorized.For example, security module 312 may provide user credentials, such as ausername and password received via user input, to server 304 so thatauthenticator module 322 can authenticate the user account associatedwith client device 302. In some embodiments, server 304 may provide eachclient device 302 with a unique security key so that client application310 need not provide user credentials each time it attempts tocommunicate with server 304 and/or synchronize data. The security keycan be a randomly generated value that would be computationallydifficult or impossible to guess. In some embodiments, the security keycan be a private key that may be used to create digital signatures inasymmetric cryptography (also known as public key cryptography). In suchembodiments, client device 302 may encrypt messages with the securitykey on a per-message basis before sending them out to server 304. Server304 can then use a matching public key to decrypt the message and verifythat the message comes from a legitimate source. In some otherembodiments, the security key can be a symmetric key or a session keythat is shared by both client device 302 and server 304. The session keymay be used to encrypt all messages that are communicated between client302 and server 304 during a communication session. For example, a securechannel, such as a Transport Layer Security (TLS) or Secure Socket Layer(SSL) channel, can be established between client 302 and server 304 byusing the security key. If a user account is associated with more thanone client devices, such as when the user synchronizes her user dataamong two or more client devices, server 304 may generate and issuedifferent security keys to the client devices so that each client devicewould have a unique security key. On the other hand, if more than oneuser account is associated with a single client device, server 304 mayalso generate and issue unique security keys for each of the useraccounts on the device.

Security module 312 may store active security key 316 and candidate key318, although the keys may be stored elsewhere on client device 302.Keys 316, 318 may be stored in a secure and/or obscure location insideclient device 302 so that a malicious user who may gain access to clientdevice 302 could not discover keys 316, 318 easily. Active key 316 is asecurity key that has been issued by server 304 and is currently beingused by client application 310 for authentication with server 304.Meanwhile, candidate key 318 may have been issued by server 304 as acandidate for a new security key to replace active key 316, but has notbeen activated yet. The use of candidate keys may be necessary forsynchronization of the key renewal process between client device 302 andserver 304. Client application 310 can hold candidate key 318 until thekey rotation process is successfully completed and then start usingcandidate 318 as the new active key. If, however, the key rotationprocess is not successful, then client application 310 may discardcandidate key 318 and start the process all over again to receive a newcandidate key.

Timer module 314 can allow client application 310 to periodically rotatesecurity keys by keeping track of key rotation schedule(s) and signalingto client application 310 when active key 316 needs to be refreshed.Timer 314 can run on a predefined time schedule. For example, timer 314may be set up so that client application 310 rotates its key(s) every 24hours. Those of skill in the art will understand that the key rotationschedule may be based on other fixed time durations, such as 6 hours, 7days, 1 month, etc. The key rotation schedule may also be dynamicallyadjusted rather than being based on fixed time schedules. For example,timer module 314 may adjust the key rotation interval depending ondynamic factors such as network traffic, overall security level,presence of malicious activities (e.g., hacking attempts detected),security policy change, user request, etc. In some embodiments, clientdevice 302 may lack timer module 314. In such embodiments, key rotationcan be initiated by server 304 rather than by client 302. Server 304 maytransmit a key expiration notification message to client 302 to letclient application 310 know that active key 316 is no longer valid (orwill expire soon) so that client application 310 may start the keyrotation process.

In a multi-user environment, client application 310 may store more thanone active keys and/or candidate keys (not shown in FIG. 3). Forexample, client device 302, such as a desktop computer, can be used bymore than one user, each of whom may have a separate user account onserver 304. If the client device and/or the client application isconfigured to handle two or more user accounts, the user accounts may beeach assigned a unique security key. Depending on which one of themultiple users is using client device 302 at the moment, clientapplication 310 may use one of many active security keys that are storedinside client device 302 to authenticate or communicate with server 304.Accordingly, client application 310 can also record, for example in adatabase, associations between the user accounts and the active securitykeys in order to keep track of which security key is associated withwhich user account. The users may have to input correct user credentialsto client application 310 before client application 310 is able toretrieve the appropriate active key for the user. Similarly, multiplecandidate keys can be stored inside client device 302 at a given time sothat key rotation can be performed on more than one security key at atime. Timer 314 can also keep track of multiple key expiration times formultiple user accounts.

Server 304 can communicate through communications interface 320 withclient device 302 via network 306. Server 304 can be a contentmanagement system, such as content management system 106 of FIG. 1.Accordingly, communications interface 320 and authenticator module 322may correspond to communications interface 120 and authenticator module126 of FIG. 1. Although server 304 is shown in FIG. 3 to have only twomodules 320, 322, those of ordinary skill in the art will recognize thatserver 304 can have other hardware and software modules, such as one ormore of the exemplary modules for content management system 106 shown inFIG. 1.

Communications interface 320, such as a modem, a NIC, an Ethernetadapter, a Wi-Fi adapter, etc., enables server 304 to communicate withclient device 302 and other client devices via network 306.Authenticator module 322 that resides in server 304 can verify usercredentials, security tokens, security keys, API calls, client devices,etc. to ensure only authorized clients and users may communicate withserver 304 and/or access content stored in server 304. Authenticatormodule 322 can communicate with communications interface 320 to reachnetwork nodes outside server 304, such as client device 302.Authenticator module 322 may include one or more sub-modules orsub-components, such as key generator 324, active key storage 326, andcandidate key storage 328. However, those of skill in the art willunderstand that each of these sub-modules may well exist outsideauthenticator module 322 or even outside server 304 as a module,component, or device independent from authenticator module 322 and/orserver 304. Moreover, one or more of the sub-modules can be combinedwith one another. For example, in some configurations, active keystorage 326 and candidate key storage 328 may reside inside one singlephysical storage device or a group of physical storage devices. Thesephysical storage device(s) may also be consolidated with user accountdatabase 150 and/or content storage 160, as shown in FIG. 1.

Key generator sub-module 324 may be a software or hardware module thatcan randomly generate values, such as numbers and alphanumeric strings.For example, key generator 324 can be configured to generate random128-bit hexadecimal numbers that are unique from each other. In someembodiments, key generator 324 can generate asymmetric private-publickey pairs. In other embodiments, key generator 324 can generatesymmetric keys such as session keys. Once generated, these security keysmay be first treated as a candidate key until it is agreed betweenclient 302 and server 304 that the key would become the next activesecurity key. Otherwise, the candidate key can be discarded before everbecoming an active key.

Any security keys that have been generated by key generator module 324may be placed in active key storage 326 and/or candidate key storage328. Although active key storage 326 and candidate key storage 328 areshown as two separate storage areas in FIG. 3, those of skill in the artwill understand that active keys and candidate keys can be storedtogether. When active keys and candidate keys are stored in the samelogical or physical location, authenticator module 322 can distinguishbetween the two types of keys by maintaining flags, attributes, mappingtables, etc. to mark which keys are key candidates and which keys areactive. For example, a security key may have an “active status”attribute that can be set to either 1 (i.e., “true”) or 0 (i.e.,“false”). Authenticator module 322 can then mark a candidate key as anactive key by simply flipping the attribute value from 0 to 1.

Active key storage 326 may store more than one active security keys at atime. As an example, server 304 may be serving content to more than oneclient devices. As such, server 304 can generate multiple security keys,one key for each client device. Similarly, multiple candidate keys canbe managed by server 304 when performing key rotation for multipleclient devices.

In some aspects, server 304 may generate hash values of active keys andcandidate keys and store those hashes instead of storing the actual keyvalues. Server 304 can later use the hash values to verify clientdevice's 302 security key(s). Avoiding to store the key values in server304 can reduce the risk of keys being leaked or stolen because even if amalicious attacker compromises server 304, the attacker cannot obtainthe key values.

FIG. 4 shows a first sequence diagram for an exemplary key rotationprotocol. In this example key rotation protocol 400, client 402 andserver 404 exchange various messages in order to replace the client'sactive security key with a new key. Client 402 can be client device 302or client application 310 as shown in FIG. 3. Similarly, server 404 canbe server 304 of FIG. 3. Client 402 and server 404 may exchange messagesvia a network, such as network 306 shown in FIG. 3. Each messageexchanged between client 402 and server 404 may be encrypted with asecurity key, especially the currently active security key assigned forclient 402 as agreed upon by client 402 and server 404. Key rotationprotocol 400 can be broken down into various phases, such as keyexpiration 406, 412; key issuance 416; and key confirmation 426. It isto be noted, however, that key rotation protocol 400 is only one exampleprotocol that may be used for key rotation, and other protocols orvariations to protocol 400 may be used. Moreover, the sequence ofmessage exchanges illustrated in FIG. 4 can be altered, and one or moremessages can be omitted.

At the outset, client 402 may already have an active security key thathas been issued by server 404. The security key may have been issuedwhen the client application was first installed on the client device.Alternatively, the security key may have been renewed after the initialinstallation. The security key can be stored in client 402. Server 404may also have stored inside it the identical security key (in symmetriccryptography) or a matching key (in asymmetric cryptography), such as amatching public key that can be used to verify the security key forclient 402. Alternatively, server 404 may be storing a hash value ofclient's 402 security key. Although the hash value would be differentfrom the security key, server 404 can nevertheless use the hash toverify the security key.

Before key issuance phase 416, optional key expiration phase(s) may beintroduced to initiate the key rotation process. There can be at leasttwo ways in which a security key may be invalidated (i.e., security keyexpires): invalidation by server 404 (406) and invalidation by client402 (412). In the first key expiration method 406, client 402 may not beaware of the key expiration until it is notified by server 404. Thus, inthis expiration method, the key rotation process is mandated and/orinitiated by server 404. In this key expiration method 406, client 402may send operation request 408 to server 404. Operation request 408 maybe a normal operation request that is unrelated to key rotation. Forexample, operation request 408 can be a request to authenticate user,synchronize data, update information, etc. Operation request 408 may beencrypted with the current security of client 402.

After receiving operation request 408, server 404 may determine that thecurrent active key for client 402 needs renewal. Server 404 maydetermine this based on a predetermined key renewal schedule. Forexample, if the security policy for server 404 dictates that everysecurity key needs to be rotated every 24 hours, then server 404 cancheck whether the key needs to be renewed, every time server 404receives operation request 408 or any other message from client 402, bylooking up when the security key for client 402 was last issued anddetermining whether 24 hours have passed since the time of key issuance.Server 404 can also dynamically adjust the key renewal schedule for eachclient that it serves. For example, server 404 can prematurely retire asecurity key when it detects a security threat. In another example,server 404 may experience a particularly heavy load of requests fromvarious client devices and decide to put off renewing keys for someclients. Once server 404 determines that client 402 needs a key renewal,server 404 can transmit key expiration notification message 410 toclient 402. Key expiration notification 410 is designed to put client402 on notice of expiration or impending expiration of client's 402currently active security key. In some embodiments, server 404 may sendkey expiration notification 410 to client 402 without receivingoperation request 408 first. For example, server 404 may have a timerthat triggers transmission of key expiration notification message 410 toclient 402 at predefined time intervals. Key expiration notification 410may contain such additional information as expiration time. Keyexpiration notification message 410 can also include client updateinformation in case client 402 runs a legacy client application thatdoes not yet support key rotation protocol 400. The client updateinformation can help client 402 get updated to a newer version of theapplication that supports the key rotation feature.

In lieu of or in conjunction with the first key expiration method 406,the second key expiration method 412 may be also used. The second keyexpiration method 412 involves a client-initiated key rotation process,in which client 402 determines for itself that its current security hasexpired or is about to expire, and that the key needs renewal fromserver 404. Client 402 may accomplish this with a help of timer 414,such as timer module 314 shown in FIG. 3. Timer 414 may run onpredefined renewal schedule(s) for the client's security key and informclient 402 when the security key needs to be rotated. For example, timer414 can trigger a key rotation every hour, every 12 hours, every 24hours, every week, every month, etc. Moreover, timer 414 can beconfigured to dynamically adjust the renewal schedule depending onfactors such as network traffic, server workload, presence of securitythreats, security policy change, etc.

Once client 402 determines, either by itself or after getting notifiedby server 404, a key rotation is needed, it can enter key issuance phase416. The messages exchanged in key issuance phase 416 may be encrypted.For example, a secure SSL channel encrypted with the current activesecurity key can be established between client 402 and server 404. Inthis phase, client 402 may first transmit key renewal request 418 toserver 404. Request 418 informs server 404 that client 402 is ready toreceive a new security key and retire its old key. After server 404receives key renewal request message 418, server 404 can generate acandidate key (420). The candidate key can be a randomly generatedvalue. Candidate keys can be uniquely generated each time so that no twocandidates would ever be the same. Candidate keys are security keys thatmay potentially become an active key for client 402. Server 404 canstore the newly generated candidate inside server 404 until it isdetermined whether the candidate key would become the active key forclient 402 or be discarded. Server 404 can also generate a hash value ofthe candidate key and store the hash inside server 404. Server 404 maythen issue the generated candidate key to client 402 by transmitting thekey value to client 402 (422). Encryption of the candidate key issuancemessage, for example by client's 402 active key, can ensure that thecandidate key is delivered only to the key renewal requester. This canbe accomplished by using the previously established secure SSL channel.If server 404 had generated and stored a hash value of the candidatekey, server 404 may retain the hash value but destroy the candidate keynow to reduce the risk of stolen keys. Once the candidate key isreceived, client 402 can store the newly generated candidate key in itsstorage until the key is confirmed (424).

In key confirmation phase 426, client 402 can send key receiptconfirmation message 428 to server 404. Key receipt confirmation 428signifies to server 404 that client 402 has successfully received thecandidate key. Client 402 may encrypt or encode key receipt confirmationmessage 428 using the newly received candidate key to prove to server404 that the new key was indeed received by client 402. In someembodiments, key receipt confirmation message 428 can be doublyencrypted with both the currently active key (i.e., old key) and thecandidate key (i.e., new key) to prove to server 404 that message 428originates from a trusted source (i.e., client 402) and that the trustedsource is now in possession of the newly issued security key. Whenserver 404 receives key receipt confirmation 428, it can verify client's402 claim by examining message 428. In particular, server 404 can checkto see if confirmation message 428 was indeed encrypted with thecandidate key. In some embodiments where the protocol specifies thatconfirmation message 428 be doubly encrypted, server 404 may determinethat confirmation message 428 was encrypted both with the old key andthe new key. If server 404 had generated and stored a hash value of thecandidate key, then server 404 can now use the hash value to verifymessage 428. Server 404 may retrieve the candidate key that it hasstored previously (420) to compare the key values. If server 404determines that key receipt confirmation 428 was not encrypted with thecandidate key, then server 404 may terminate the key rotation process.In some embodiments, however, server 404 can send a message to client402 notifying that the key does not match. In some other embodiments,server 404 may resend the same candidate key back to client 402. In yetsome other embodiments, server 404 may create another candidate keydifferent from the previously generated candidate key and issue the newcandidate key to client 402. Server 404 may also take a combination oftwo or more of these actions.

If, however, server 404 determines that client 402 is indeed inpossession of the correct candidate key, server 404 can mark thecandidate security key that it is storing as the new active key withregards to client 402 (430). Server 404 can accomplish this by changingthe active status flag/attribute/indicator of the candidate securitykey. For example, server 404 can change the active flag value of thecandidate security key from 0 (“false”) to 1 (“true”). In anotherexample, server 404 can change the candidate status attribute of thesecurity key from 1 (“true”) to 0 (“false”). In yet another example,server 404 can move the security key from the candidate key storage areato the active key storage area. Now that server 404 has associated a newsecurity key with client 402, server 404 may communicate with client 402from this point on using the new security key exclusively. Thus, oncethe new active key (i.e., previously candidate key) is marked as beingactive, server 404 may safely retire the client's old security key(432). Server 404 can retire the old key by deleting the key value orsevering the link between the key value and client 402. Alternatively,retiring the old key may be performed prior to marking the candidate keyas new active key. In some embodiments, a security key may never bereused once it is retired.

In some configurations, once the old key is retired, a client device maynot be allowed to request another key renewal using the retired key. Inother words, each security key may be allowed exactly one key renewal.This renewal policy can minimize the chance that a malicious actor mightprolong her unauthorized access by continuing to rotate her own stolenkey. For example, let us assume that client 402 had security key 1 asits active security key, which was inadvertently leaked to a maliciousthird party at 8:00 PM one evening. Server 404 may mandate that all itsclients' security keys be renewed every 24 hours at midnight everynight. Client 402 may receive key expiration notification 410 at 12:00AM that night and go through key issuance phase 416 and key confirmationphase 426 to obtain security key 2 as its new active security key. Bothclient 402 and server 404 have retired security key 1 by the end of keyconfirmation phase 426. When the malicious third party attempts to renewsecurity key 1 via her own client device or application by sending a keyrenewal request to server 404, server 404 can simply disregard thisrequest because security key 1 had already been refreshed for client 402by server 404. Thus, in this example, the malicious third party'sunauthorized access to server 404 using the stolen security key lastedonly for a limited time (i.e., 4 hours). Optionally, server 404 may senda warning message to client 402 to let the user know that there had beena potentially malicious attempt to intercept the security key by a rogueclient device.

If, however, the malicious third party somehow beats client 402 to thepunch and manages to send a key renewal request to server 404 beforeclient 402 does, server 404 may send out a notification message to theuser account associated with client 402 through an alternative channelin order to warn of a potentially suspicious activity. This notificationmessage can be sent out only when server 404 determines that there isenough suspicion that an illicit activity may be going on, such as whenserver 404 suddenly gets a key renewal request from an unfamiliar clientdevice. For example, when the malicious third party manages to reachserver 404 to refresh the key, server 404 may detect that the request issent from a device that server 404 does not recognize. Server 404 mayattempt to reach the user associated with client 402 by an alternativemeans, such as email, text message, telephone, online chat, mail, etc.to notify the user that the key was renewed by an unrecognized device.In some embodiments, the notification can be delivered directly to theclient application belonging to client 402. For example, when client 402attempts key renewal by sending key renewal request 418 to server 404,instead of issuing a candidate key (422), server 404 can send anotification message to client 402 indicating that security key 1 hasbeen already renewed by another client device and requesting to the userto verify the renewal and/or report any suspicious activity. Once theuser finds out about the potential foul play, he can contact the onlinecontent management service to reinstate his client device into the loopby obtaining yet another security key and invalidating the maliciousthird party's new security key. The user may be asked to provide hisuser credentials to verify that he is the authorized user.Alternatively, the warning message may be sent out to the user after theillicit renewal request is received but before actually renewing thekey. The key can then be rotated only after the user personallyauthorizes the key renewal. The authorization may be accompanied with arequest to provide user credentials to prove that the key rotationrequest comes from the legitimate user. In addition, the malicious thirdparty's client application can be asked to provide user credentials aswell. By implementing some of the mechanisms described above, server 404can prevent malicious actors from stealing security keys and obtainingunauthorized access for an extended period of time.

Server 404 may send acknowledgment (“ACK”) message 434 to client 402 toinform client 402 that the candidate key is now activated in server 404and that client 402 is expected to use the candidate key as the newactive key from that point on. Server 404 may encrypt or encode ACKmessage 434 with the new active key (i.e., previously candidate key).After receiving ACK message 434 and/or verifying that message 434 wasencrypted with the candidate key, client 402 may then mark the candidatekey, which client 402 has stored in a previous step (424), as its newactive key (436). Client 402 may now communicate and/or authenticatewith server 404 using the newly activated key. Client 402 may alsoretire the old security key after receiving ACK 434 by discarding theold key value. After one round of key rotation process 400 is complete,client 402 and server 404 may communicate with each other using thenewly issued key until, once again, client 402 receives key expirationnotification message 410 from server 404 and/or timer 414 expires andnotifies client 402. Key issuance phase 416 and key confirmation phase426 may then be repeated to complete another cycle of key rotation.

FIG. 5 shows a second sequence diagram for the exemplary key rotationprotocol. Specifically, FIG. 5 shows an exemplary exception handlingscenario 500 for exemplary key rotation protocol 400. After client 502transmits exchange key renewal request message 506 to server 504; server504 generates a candidate key (508); and server 504 issues the candidatekey to client 502 (510) in a similar manner to key issuance phase 416 ofFIG. 4, server 504 may proceed to mark the candidate key as the newactive key for client 502 (514), and retire client's 502 old securitykey (516) in a similar manner to the key confirmation phase 426 of FIG.4. However, when server 504 sends out ACK message 518 that is destinedfor client 502, ACK message 518 can get lost mid-transmission and neverreach its intended destination, client 502, in time. Under such anexceptional circumstance, client 502 may send another key receiptconfirmation message 520 to server 504 in order to elicit another ACKmessage from server 504. In some embodiments, key receipt confirmationmessage 520 can be identical to key receipt confirmation message 512. Inother embodiments, key receipt confirmation message 520 may includeadditional information such as the number of retries. The repeat keyreceipt confirmation messages can be sent out to server 504 when apredetermined period of time (i.e., wait time) elapses after theprevious confirmation is sent out and client 502 fails to receive ACK518. When server 504 receives the second key receipt confirmationmessage 520, server 504 can simply retransmit ACK 518 without issuinganother candidate key.

In some embodiments, if client 502 fails to receive ACK 518 from server504 even after repeated attempts to send confirmation messages, forexample after a predefined number of confirmation messages are sent outwithout success, the entire key renewal process may be considered afailure and client 502 may have to reinitiate the whole process bysending out a fresh key renewal request. In such a case, server 504 maydiscard the previously issued candidate key and generate a new candidatekey.

FIG. 6 shows a third sequence diagram for the exemplary key rotationprotocol. Specifically, FIG. 6 shows another exemplary exceptionhandling scenario 600 for exemplary key rotation protocol 400. Whenclient 602 transmits key renewal request message 606 to server 604, in asimilar manner to key renewal request message 418 of FIG. 4, server 604can generate a candidate key (608) and transmit the first candidate keyback to client 602 (610). However, the first candidate key may get lostin transit or its transmission may be delayed because of, for example,poor network conditions. Client 602 may never receive the firstcandidate key or fail to receive the key within the predefined waitingtime (e.g., 10 seconds).

In such an exceptional case, client 602 can reinitiate the key rotationprocess by sending another key renewal request 612 to server 604. Client602 may continue to send out key renewal requests, for example up to apredefined number of times, until client 602 receives a candidate keyfrom server 604. Server 604, after receiving the repeat request 612, cansimply retransmit the first candidate key back to client 602. However,in some embodiments, server 604 can generate another candidate key(614). The first candidate key previously generated in step 608 may nowbe discarded. Generating a new candidate key each time server 604receives a renewal request can help increasing security of the protocoland bolstering key integrity by ensuring that every security key isissued to one client device only and that no security key is reused. Itmay also decrease the risk of a key leak because key retransmissionswould be limited.

Server 604 can then issue the second candidate key to client 602 (616).Client 602 can receive the second candidate key and store the receivedkey as the candidate key (618). Client 602 may then send key receiptconfirmation message 620 to server 604 to continue on with keyconfirmation phase 426 as shown in FIG. 4. Client 602 may encryptconfirmation message 620 with the second candidate key prior to sendingthe message out. Message 620 can also be doubly encrypted with theactive key and the second candidate key. However, prior to or afterconfirmation message 620 is sent out but after the second candidate keyis received by client 602 (616), the first candidate key previouslyissued in step 610 may mysteriously rematerialize from the network andbelatedly reach client 602 (622). Alternatively, the first candidate keymight have gotten delayed, for example because of adverse networkconditions, but may nevertheless manage to reach its destination, client602, after the second candidate key had already reached client 602. Insuch a scenario, client 602 may safely ignore the first candidate keyand not respond to it. In other words, client 602 can be configured toonly store and respond to the candidate key that it receives first anddisregard any subsequent delivery of candidate key(s). Server 604 canalso be configured to ignore any key receipt confirmation messages thatmay have been encrypted with the first candidate key, which has beenalready discarded by server 604.

Having disclosed some basic system components and concepts, thedisclosure now turns to the example method embodiments shown in FIGS.7-8. For the sake of clarity, the methods are described in terms ofsystem 200, as shown in FIG. 2A, configured to practice the method.Alternatively, however, the methods may also be practiced by clientdevice 102 i, service provider 109 i, or online content managementsystem 106, as shown in FIG. 1; system 250 as shown in FIG. 2B; orclient device 302, client application 310, or server 304, as shown inFIG. 3. The steps outlined herein are exemplary and can be implementedin any combination thereof in any order, including combinations thatexclude, add, or modify certain steps.

FIG. 7 shows an exemplary method embodiment. First, system 200 may send,to a server from a client device having a first security key as anactive security key, a request for a second security key as areplacement for the first security key (702). The request can be arenewal request. Here, system 200 can be the client device and theserver can be an online synchronized content management system.Moreover, any communication between the client device and the server canbe encrypted with the active security key. The communication may includesynchronizing a content item between the client device and the server.The communication may also include authentication of the client deviceby the server. Prior to sending the request to the server, system 200can send, from the client device to the server, an operation requestencrypted with the first security key. Then, also prior to sending therequest, system 200 can receive a message from the server, the messageindicating that the first security key has expired. Alternatively,sending the request can be triggered by a timer in the client device,the timer periodically triggering the client device to renew the activesecurity key.

System 200 may receive a candidate security key from the server (704).System 200 may then store the candidate security key on the clientdevice (706). System 200 may encrypt a key receipt confirmation messagewith the candidate security key (708). The key receipt confirmationmessage can also be doubly encrypted with the first security key (i.e.,current active security of the client device). System 200 may then sendthe key receipt confirmation message to the server (710). In response,the server can send an acknowledgment message. System 200 may receivethe acknowledgment message from the server (712). After the receipt ofthe acknowledgement message, system 200 may mark the candidate securitykey as the active security key (714). In other words, system 200 mayrenew the active security key by replacing the first key with a secondkey (i.e., candidate key). Once the first security key becomes obsolete,system 200 may discard the first security key (716).

In certain situations, for example, after receiving the candidatesecurity key, system 200 may receive an additional candidate securitykey from the server. System 200 may then discard the additionalcandidate without sending an additional key receipt confirmation messageto the server. In some other situations, for example, when apredetermined time period elapses after sending the key receiptconfirmation message without receiving the acknowledgment message,system 200 may resend the key receipt confirmation message to theserver.

FIG. 8 shows another exemplary method embodiment. First, system 200 mayreceive, at a server from a client device, a request for a new securitykey (802). In this exemplary embodiment, system 200 can be the server.System 200 also can be an online synchronized content management system.Prior to receiving the request, however, system 200 may have received,at the server from the client device, an operation request encryptedwith an expired security key. The expiration of the key could have beendetermined by the server after receiving the operation request. System200 could have then sent an expired security key notification to theclient device, and denied the client device any further service untilthe request for the new security key is received from the client device.

After the request for the new security key is received at the server,system 200 may generate a candidate security key (804). The candidatesecurity key can be generated in response to a key renewal request fromthe client device. The candidate security key can be a randomlygenerated value, such as a hexadecimal string, that is unique to theclient device. In a multi-user environment, one candidate security keycan be generated per user account per client device. For example, ifAlice and Bob, each having a separate user account with a contentmanagement system, share two client devices—a laptop computer and atablet computer—the content management system may generate fourdifferent security keys: two keys for Alice and Bob, respectively, onthe laptop computer, and two more keys for Alice and Bob, respectively,on the tablet computer. Next, once the key is generated, system 200 cansend the candidate security key to the client device (806). If system200 receives a second request for the new security key, however, system200 can generate a second candidate security key different from thefirst candidate security key, and send the second candidate security keyto the client device. In such a case, the first candidate security keymay be discarded and not used again.

The client device may send a key receipt confirmation message, andsystem 200 may receive the key receipt confirmation message from theclient device (808). The client may have encrypted the key receiptconfirmation message with the newly received candidate key. In addition,the message could have also been encrypted with the client device'sactive key. In order to verify that the client device has received thecandidate key, system 200 can determine whether the key receiptconfirmation message has been encrypted by the client device using thecandidate security key (810). Sometime after receiving the key receiptconfirmation message, system 200 can retire an old security keyassociated with the client device (812). The old security key can be theactive key of the client device prior to the current round of keyrotation. In some embodiments, the old security key may be retired onlyafter it is verified that the candidate key was successfully received bythe client device. Sometime after receiving the key receipt confirmationmessage, system 200 may mark the candidate security key as the newsecurity key for the client device (814). From this point on, system 200may use the new security key (i.e., previously the candidate key) tocommunicate with and authenticate the client device. Finally, system 200may send an acknowledgement message to the client device (816). Inresponse, the client device may also mark its candidate key as the newactive key and retire the previous active key.

For clarity of explanation, in some instances the present technology maybe presented as including individual functional blocks includingfunctional blocks comprising devices, device components, steps orroutines in a method embodied in software, or combinations of hardwareand software.

In some embodiments, the computer-readable storage devices, mediums, andmemories can include a cable or wireless signal containing a bit streamand the like. However, when mentioned, non-transitory computer-readablestorage media expressly exclude media such as energy, carrier signals,electromagnetic waves, and signals per se.

Methods according to the above-described examples can be implementedusing computer-executable instructions that are stored or otherwiseavailable from computer readable media. Such instructions can comprise,for example, instructions and data which cause or otherwise configure ageneral purpose computer, special purpose computer, or special purposeprocessing device to perform a certain function or group of functions.Portions of computer resources used can be accessible over a network.The computer executable instructions may be, for example, binaries,intermediate format instructions such as assembly language, firmware, orsource code. Examples of computer-readable media that may be used tostore instructions, information used, and/or information created duringmethods according to described examples include magnetic or opticaldisks, flash memory, USB devices provided with non-volatile memory,networked storage devices, and so on.

Devices implementing methods according to these disclosures can comprisehardware, firmware and/or software, and can take any of a variety ofform factors. Typical examples of such form factors include laptops,smart phones, small form factor personal computers, personal digitalassistants, and so on. Functionality described herein also can beembodied in peripherals or add-in cards. Such functionality can also beimplemented on a circuit board among different chips or differentprocesses executing in a single device, by way of further example.

The instructions, media for conveying such instructions, computingresources for executing them, and other structures for supporting suchcomputing resources are means for providing the functions described inthese disclosures.

Although a variety of examples and other information was used to explainaspects within the scope of the appended claims, no limitation of theclaims should be implied based on particular features or arrangements insuch examples, as one of ordinary skill would be able to use theseexamples to derive a wide variety of implementations. Further andalthough some subject matter may have been described in languagespecific to examples of structural features and/or method steps, it isto be understood that the subject matter defined in the appended claimsis not necessarily limited to these described features or acts. Forexample, such functionality can be distributed differently or performedin components other than those identified herein. Rather, the describedfeatures and steps are disclosed as examples of components of systemsand methods within the scope of the appended claims. Thus, the claimsare not intended to be limited to the aspects shown herein, but are tobe accorded the full scope consistent with the language claims, whereinreference to an element in the singular is not intended to mean “one andonly one” unless specifically so stated, but rather “one or more.”

A phrase such as an “aspect” does not imply that such aspect isessential to the subject technology or that such aspect applies to allconfigurations of the subject technology. A disclosure relating to anaspect may apply to all configurations, or one or more configurations. Aphrase such as an aspect may refer to one or more aspects and viceversa. A phrase such as a “configuration” does not imply that suchconfiguration is essential to the subject technology or that suchconfiguration applies to all configurations of the subject technology. Adisclosure relating to a configuration may apply to all configurations,or one or more configurations. A phrase such as a configuration mayrefer to one or more configurations and vice versa.

The word “exemplary” is used herein to mean “serving as an example orillustration.” Any aspect or design described herein as “exemplary” isnot necessarily to be construed as preferred or advantageous over otheraspects or designs. Moreover, claim language reciting “at least one of”a set indicates that one member of the set or multiple members of theset satisfy the claim.

What is claimed is:
 1. A method comprising: sending, to a server from aclient device having a first security key as an active security key, aplurality of requests for a new security key as a replacement for thefirst security key, wherein each request of the plurality of requests isencrypted with the first security key; receiving two or more candidatesecurity keys from the server, wherein the two or more candidatesecurity keys are generated in response to the plurality of requests;sending a key receipt confirmation message to the server, wherein thekey receipt confirmation is encrypted with a selected candidate securitykey of the two or more candidate security keys and the first securitykey; marking the selected candidate security key as the active securitykey.
 2. The method of claim 1, wherein the server is an onlinesynchronized content management system.
 3. The method of claim 1,wherein communication between the client device and the server isencrypted with the active security key.
 4. The method of claim 3,wherein the communication comprises synchronizing a content item betweenthe client device and the server.
 5. The method of claim 1, furthercomprising: upon receiving the selected candidate security key of thetwo or more candidate security keys, storing the selected candidatesecurity key on the client device.
 6. The method of claim 5, furthercomprising: discarding one or more additional candidate security keyswithout sending an additional key receipt confirmation message to theserver.
 7. The method of claim 1, further comprising: discarding thefirst security key after marking the selected candidate security key asthe active security key.
 8. The method of claim 1, further comprising:prior to sending the plurality of requests: sending, from the clientdevice to the server, an operation request associated with the firstsecurity key; and receiving a message from the server, the messageindicating that the first security key has expired.
 9. The method ofclaim 1, wherein sending the plurality of requests is triggered by atimer in the client device, the timer periodically triggering the clientdevice to renew the active security key.
 10. A system comprising: aprocessor; and a non-transitory computer-readable storage medium storinginstructions which, when executed by the processor, cause the processorto perform operations comprising: sending, to a server from a clientdevice having a first security key as an active security key, aplurality of requests for a new security key as a replacement for thefirst security key, wherein each request of the plurality of requests isencrypted with the first security key; receiving two or more candidatesecurity keys from the server, wherein the two or more candidatesecurity keys are generated in response to the plurality of requests;sending a key receipt confirmation message to the server, wherein thekey receipt confirmation is encrypted with a selected candidate securitykey of the two or more candidate security keys and the first securitykey; marking the selected candidate security key as the active securitykey.
 11. The system of claim 10, wherein the server is an onlinesynchronized content management system.
 12. The system of claim 10,wherein communication between the client device and the server isencrypted with the active security key.
 13. The system of claim 12,wherein the communication comprises synchronizing a content item betweenthe client device and the server.
 14. The system of claim 10, theoperations further comprising: upon receiving the selected candidatesecurity key of the two or more candidate security keys, storing theselected candidate security key on the client device.
 15. The system ofclaim 14, the operations further comprising: discarding one or moreadditional candidate security keys without sending an additional keyreceipt confirmation message to the server.
 16. The system of claim 10,the operations further comprising: discarding the first security keyafter marking the selected candidate security key as the active securitykey.
 17. The system of claim 10, the operations further comprising:prior to sending the plurality of requests: sending, from the clientdevice to the server, an operation request associated with the firstsecurity key; and receiving a message from the server, the messageindicating that the first security key has expired.
 18. The system ofclaim 10, wherein sending the plurality of requests is triggered by atimer in the client device, the timer periodically triggering the clientdevice to renew the active security key.
 19. A non-transitorycomputer-readable storage medium storing instructions which, whenexecuted by a processor, cause the processor to perform operationscomprising: sending, to a server from a client device having a firstsecurity key as an active security key, a plurality of requests for anew security key as a replacement for the first security key, whereineach request of the plurality of requests is encrypted with the firstsecurity key; receiving two or more candidate security keys from theserver, wherein the two or more candidate security keys are generated inresponse to the plurality of requests; sending a key receiptconfirmation message to the server, wherein the key receipt confirmationis encrypted with a selected candidate security key of the two or morecandidate security keys and the first security key; marking the selectedcandidate security key as the active security key.
 20. Thenon-transitory computer-readable storage medium of claim 19, wherein theserver is an online synchronized content management system.
 21. Thenon-transitory computer-readable storage medium of claim 19, whereincommunication between the client device and the server is encrypted withthe active security key.
 22. The non-transitory computer-readablestorage medium of claim 21, wherein the communication comprisessynchronizing a content item between the client device and the server.23. The non-transitory computer-readable storage medium of claim 19, theoperations further comprising: upon receiving the selected candidatesecurity key of the two or more candidate security keys, storing theselected candidate security key on the client device.
 24. Thenon-transitory computer-readable storage medium of claim 23, theoperations further comprising: discarding one or more additionalcandidate security keys without sending an additional key receiptconfirmation message to the server.
 25. The non-transitorycomputer-readable storage medium of claim 19, the operations furthercomprising: discarding the first security key after marking the selectedcandidate security key as the active security key.
 26. Thenon-transitory computer-readable storage medium of claim 19, theoperations further comprising: prior to sending the plurality ofrequests: sending, from the client device to the server, an operationrequest associated with the first security key; and receiving a messagefrom the server, the message indicating that the first security key hasexpired.
 27. The non-transitory computer-readable storage medium ofclaim 19, wherein sending the plurality of requests is triggered by atimer in the client device, the timer periodically triggering the clientdevice to renew the active security key.